leviathan
9593d90385
Breaking change. Tool name, binary name, function/type names,
constant names, env vars, header guards, file paths, and GitHub
repo URL all rebrand IAMROOT → SKELETONKEY.
Changes:
- All "IAMROOT" → "SKELETONKEY" (constants, env vars, enum
values, docs, comments)
- All "iamroot" → "skeletonkey" (functions, types, paths, CLI)
- iamroot.c → skeletonkey.c
- modules/*/iamroot_modules.{c,h} → modules/*/skeletonkey_modules.{c,h}
- tools/iamroot-fleet-scan.sh → tools/skeletonkey-fleet-scan.sh
- Binary "iamroot" → "skeletonkey"
- GitHub URL KaraZajac/IAMROOT → KaraZajac/SKELETONKEY
- .gitignore now expects build output named "skeletonkey"
- /tmp/iamroot-* tmpfiles → /tmp/skeletonkey-*
- Env vars IAMROOT_MODPROBE_PATH etc. → SKELETONKEY_*
New ASCII skeleton-key banner (horizontal key icon + ANSI Shadow
SKELETONKEY block letters) replaces the IAMROOT banner in
skeletonkey.c and README.md.
VERSION: 0.3.1 → 0.4.0 (breaking).
Build clean on Debian 6.12.86. `skeletonkey --version` → 0.4.0.
All 24 modules still register; no functional code changes — pure
rename + banner refresh.
2.2 KiB
Pwnkit — CVE-2021-4034
🔵 DETECT-ONLY as of 2026-05-16. Full exploit follows.
Summary
Polkit's pkexec parses argv assuming argc ≥ 1. With argc == 0, the
parsing reads past argv[0] into the contiguous envp region, treating
the first env string as if it were argv[0]. By placing GCONV_PATH=
crafted entries in the environment and naming a controlled file such
that libc's iconv() loads it as a gconv module, an unprivileged user
gets code execution as root via the setuid pkexec binary.
Disclosed by Qualys 2022-01-25. Bug existed since pkexec's first release in 2009 — affects every distribution shipping a vulnerable polkit until 0.121 (or distro backport).
Affected versions
- All polkit ≤ 0.120 (i.e., pkexec from 2009 onward) before the fix landed.
- Patched in upstream polkit 0.121 (2022-01-25).
- Distro backports vary:
- Ubuntu: 0.105-26ubuntu1.3 (focal), 0.105-31ubuntu0.1 (impish), etc.
- Debian: 0.105-31+deb11u1 (bullseye), 0.105-26+deb10u1 (buster)
- RHEL: polkit-0.115-13.el7_9 (RHEL 7), polkit-0.117-9.el8_5.1 (RHEL 8)
SKELETONKEY detect logic (current)
- Resolve pkexec binary (
/usr/bin/pkexecorwhich pkexec) - If not present → SKELETONKEY_OK (no attack surface)
- Run
pkexec --versionand parse version - Compare to known-fixed thresholds; report VULNERABLE if below
Exploit logic (follow-up)
Canonical Qualys / public Pwnkit PoC:
- Build a malicious shared object that
exit(setuid(0)); system("/bin/sh") - Build a
GCONV_PATH=./Xenv entry plusCHARSET=Xso libc's iconv (used by pkexec for argv decoding) loads our .so execve("/usr/bin/pkexec", { NULL }, envp)— argc=0 triggers the read past argv[0], which sees our GCONV_PATH crafted string, then pkexec gives us root context, the gconv module loads our .so as root, we drop to a shell
~200 lines including the embedded .so generator. Phase 7 follow-up commit lands the full version.
Detection rules (shipped)
detect/auditd.rules — flags pkexec invocations from non-root.